fix(engine): count cascaded asBlocked after a broker-failed elevated edge (#19)

When ``brokerSpawn`` returns ``ok = false`` for a ``requiresElevation``
edge, the engine calls ``blockClosure`` to mark every transitively
dependent edge as ``asBlocked``. The surrounding ``inc completed``
only counted THIS one failed root — the cascaded blocked descendants
stayed invisible to the loop's ``completed < total`` termination
check, so the next iteration found no pending / running / ready work
and raised the spec-mandated ``build graph made no progress; pending
actions: `` diagnostic with an EMPTY pending list (the surviving
actions were ``asBlocked``, not ``asPending``).

The error path's diagnostic gets projected by ``apply_build_actions``
onto every input action, so on the L3 production-profile apply this
surfaces as:

  - build-action actionsRunnerZip: build engine raised BuildEngineError: \
      build graph made no progress; pending actions:
  - build-action actionsRunnerExtracted: build engine raised BuildEngineError: \
      build graph made no progress; pending actions:
  - build-action runnerRegistered: build engine raised BuildEngineError: \
      build graph made no progress; pending actions:

with the empty trailing list and IDENTICAL message across all 3
edges — even though only ``actionsRunnerZip`` actually failed
(``actionsRunnerExtracted`` and ``runnerRegistered`` depend on it
and were correctly cascaded to ``asBlocked`` by ``blockClosure``).

Every OTHER ``blockClosure`` site in the engine already uses
``completed = terminalCount()`` for this exact reason; the broker-
returns-ok=false branch was the lone offender. Align it.

Add a regression test: a 3-action chain with the root broker call
returning ``ok = false`` must terminate with the root ``asFailed``
and the two deps ``asBlocked``, NOT raise ``BuildEngineError``.

--no-verify: pre-existing prek migration-mode failure
(no .pre-commit-config.yaml in repo).

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: zah

libs/repro_build_engine/src/repro_build_engine.nim

@@ -4076,6 +4076,22 @@ proc runBuild*(g: BuildGraph; config: BuildEngineConfig): BuildRunResult =
               "exit=" & $brokerOutcome.exitCode)
             blockClosure(id, id)
             emitProgress(bpkActionCompleted, id)
+            # ``blockClosure`` marks every transitively-dependent
+            # action as ``asBlocked`` without touching the local
+            # ``completed`` counter. ``inc completed`` here would
+            # only count THIS action (the broker-failed one) — the
+            # cascaded blocked descendants would stay invisible to
+            # the loop's "completed < total" termination check, so
+            # the next iteration would find no pending / running /
+            # ready work and raise the spec-mandated
+            # ``build graph made no progress; pending actions: ``
+            # diagnostic with an empty pending list. Every OTHER
+            # blockClosure site in this file uses ``terminalCount()``
+            # for exactly this reason; this branch was the lone
+            # offender.
+            completed = terminalCount()
+            launchedAny = true
+            continue
           inc completed
           launchedAny = true
           continue

libs/repro_build_engine/tests/test_elevated_inline_exec_hook.nim

@@ -246,6 +246,74 @@ suite "Windows-System-Resources Phase E — engine broker-dispatch hook":
     # the file's absence here is the negative pin.
     check not fileExists(outputPath)
 
+  test "broker returns ok=false on root edge — cascaded asBlocked deps are counted (regression)":
+    ## Regression for a build-engine scheduler bug: when ``brokerSpawn``
+    ## returns ``ok = false`` for a root elevated edge, the engine
+    ## calls ``blockClosure`` to mark every transitively-dependent
+    ## edge as ``asBlocked``. The surrounding ``inc completed`` ONLY
+    ## counted the failed root, NOT the cascaded blocked deps — so
+    ## the next loop iteration saw ``completed < total`` with no
+    ## pending / running / ready work and raised
+    ## ``build graph made no progress; pending actions: `` (with an
+    ## empty pending list because all surviving actions were
+    ## ``asBlocked``, not ``asPending``).
+    ##
+    ## Every OTHER ``blockClosure`` site in the engine uses
+    ## ``completed = terminalCount()`` for exactly this reason. The
+    ## fix aligns the broker-returns-ok=false branch with the same
+    ## pattern.
+    ##
+    ## Pin: a 3-action chain (root + 2 dependents) where the root
+    ## broker call returns ``ok = false`` must terminate with the
+    ## root ``asFailed`` and the two deps ``asBlocked`` — NOT raise
+    ## ``BuildEngineError``.
+    resetTmp()
+    let cacheRoot = TmpDir / "cache-cascade"
+    let rootOut = absolutePath(TmpDir / "outputs-cascade" / "root.out")
+    let midOut  = absolutePath(TmpDir / "outputs-cascade" / "mid.out")
+    let leafOut = absolutePath(TmpDir / "outputs-cascade" / "leaf.out")
+    createDir(cacheRoot)
+    createDir(splitPath(rootOut).head)
+
+    let rec = newRecorder(returnOk = false, returnExitCode = 1,
+      stderrText = "simulated broker failure\n",
+      diagnosticText = "simulated broker failure")
+    var root = elevatedAction("t-root", rootOut, @["/bin/true"],
+      fingerprintToken = "cascade-root")
+    var mid = elevatedAction("t-mid", midOut, @["/bin/true"],
+      fingerprintToken = "cascade-mid")
+    mid.deps = @["t-root"]
+    var leaf = elevatedAction("t-leaf", leafOut, @["/bin/true"],
+      fingerprintToken = "cascade-leaf")
+    leaf.deps = @["t-mid"]
+
+    let g = graph(@[root, mid, leaf], newSeq[BuildPool]())
+    var raised = false
+    var res: BuildRunResult
+    try:
+      res = runBuild(g, elevatedConfig(cacheRoot, rec))
+    except BuildEngineError:
+      raised = true
+    check not raised  # the engine MUST NOT raise the "no progress" error.
+    check res.results.len == 3
+    var statusById = newSeq[tuple[id: string; status: ActionStatus]]()
+    for r in res.results:
+      statusById.add((id: r.id, status: r.status))
+    var rootStatus, midStatus, leafStatus = asPending
+    for s in statusById:
+      case s.id
+      of "t-root": rootStatus = s.status
+      of "t-mid":  midStatus  = s.status
+      of "t-leaf": leafStatus = s.status
+      else: discard
+    check rootStatus == asFailed
+    check midStatus  == asBlocked
+    check leafStatus == asBlocked
+    # The broker was invoked exactly once — for the root. The
+    # cascaded blocked deps must NOT reach the broker.
+    check rec.invocations.len == 1
+    check rec.invocations[0].actionId == "t-root"
+
   test "non-elevated edges remain byte-identical (broker hook ignored)":
     ## A graph with NO ``requiresElevation = true`` edges must run
     ## end-to-end without consulting the broker hook even when one